polymarket-equity-markets-trader 安全扫描报告 — 低风险 | ClawSafe

15 /100

polymarket-equity-markets-trader

Trades Polymarket prediction markets on stock index milestones, IPOs, earnings surprises, and company-specific financial events

A legitimate Polymarket trading bot using the simmer-sdk SDK with no malicious behavior detected. The skill safely defaults to paper trading mode and has clear documentation matching implementation.

技能名称polymarket-equity-markets-trader

分析耗时30.4s

引擎pi

✓

可以安装

This skill is safe to use. Verify the simmer-sdk package integrity by checking its PyPI page and consider pinning a specific version for reproducibility.

安全发现 2 项

严重性	安全发现	位置
低危	Third-party SDK dependency 供应链 The skill depends on simmer-sdk from PyPI. Source code is not bundled and cannot be audited within the skill package. `simmer-sdk` → Verify simmer-sdk integrity by reviewing its PyPI page and consider pinning a known-good version in requirements.txt	`clawhub.json:1`
提示	Credential environment variable 敏感访问 SIMMER_API_KEY is read from os.environ for trading API authentication - this is expected behavior for a trading skill. `api_key=os.environ["SIMMER_API_KEY"]` → No action needed - credential access is required for the trading functionality and is not exfiltrated	`trader.py:68`

资源类型	声明权限	推断权限	状态	证据
网络访问	`READ`	`READ`	✓ 一致	Uses SimmerClient API calls to Polymarket
环境变量	`READ`	`READ`	✓ 一致	os.environ.get() for configuration only
命令执行	`NONE`	`NONE`	—	No subprocess or shell execution found
文件系统	`NONE`	`NONE`	—	No file read/write operations

目录结构

3 文件 · 28.4 KB · 578 行

Python 1f · 375L Markdown 1f · 130L JSON 1f · 73L

├─ 📋 clawhub.json JSON 73L · 1.2 KB

├─ 📝 SKILL.md Markdown 130L · 9.0 KB

└─ 🐍 trader.py Python 375L · 18.2 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`simmer-sdk`	`*`	pip	否	Latest version from PyPI, source not bundled for audit

安全亮点

✓ Paper trading is the safe default mode - no real trades without explicit --live flag

✓ SKILL.md documentation is comprehensive and accurately describes implementation

✓ No shell execution or subprocess calls detected

✓ No obfuscation techniques (base64, eval, atob) found

✓ No credential harvesting beyond what's needed for the trading API

✓ No hidden functionality or shadow behavior

✓ Explicit cron/autostart: null prevents automatic execution

✓ Code is clean, well-commented, and follows Python best practices